From f3e066eb154daf85b497bed70453428960b74771 Mon Sep 17 00:00:00 2001
From: Kim Gustyr <kim.gustyr@flagsmith.com>
Date: Wed, 19 Aug 2026 16:25:46 +0100
Subject: [PATCH 1/3] ci: Publish npm packages via goreleaser-npm-publisher
 with OIDC trusted publishing

---
 .github/workflows/release.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c39000f..941964f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,6 +55,29 @@ jobs:
         with:
           subject-checksums: ./dist/digests.txt
 
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: 24 # npm >= 11.5.1 required for OIDC trusted publishing
+      # TODO: swith to goreleaser-npm-publisher-action once https://github.com/evg4b/goreleaser-npm-publisher/pull/26 is released
+      - name: Build goreleaser-npm-publisher
+        run: |
+          git clone https://github.com/khvn26/goreleaser-npm-publisher "$RUNNER_TEMP/gnp"
+          cd "$RUNNER_TEMP/gnp"
+          git checkout c1e31d21c240162920cbf87c62a47e3ce306944a
+          corepack enable
+          yarn install --immutable
+          yarn build
+      - name: Publish npm packages
+        run: >-
+          node "$RUNNER_TEMP/gnp/dist/cli.cjs" publish
+          --name cli
+          --bin flagsmith
+          --prefix @flagsmith
+          --license MIT
+          --description 'The Flagsmith command-line interface'
+          --keywords flagsmith feature-flags cli
+          --files README.md LICENSE
+
       # During public beta the newest beta is what people
       # should land on, so clear it.
       - if: contains(github.ref_name, '-beta')

From 6322333fa4eae5ed7c6d8f884e651a6fcbb9a440 Mon Sep 17 00:00:00 2001
From: Kim Gustyr <kim.gustyr@flagsmith.com>
Date: Wed, 19 Aug 2026 16:46:11 +0100
Subject: [PATCH 2/3] ci: Run prebuilt npm publisher; no third-party install
 scripts in the OIDC job

---
 .github/workflows/release.yml | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 941964f..069232f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,15 +58,14 @@ jobs:
       - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 24 # npm >= 11.5.1 required for OIDC trusted publishing
-      # TODO: swith to goreleaser-npm-publisher-action once https://github.com/evg4b/goreleaser-npm-publisher/pull/26 is released
-      - name: Build goreleaser-npm-publisher
+      # TODO: switch to goreleaser-npm-publisher-action once https://github.com/evg4b/goreleaser-npm-publisher/pull/26 is released
+      # Prebuilt dist committed on the fork branch (c1e31d2 + dist/, built and
+      # smoke-tested locally). Deliberately no yarn install/build here: this job
+      # holds id-token: write, so third-party install scripts must not run in it.
+      - name: Fetch goreleaser-npm-publisher
         run: |
           git clone https://github.com/khvn26/goreleaser-npm-publisher "$RUNNER_TEMP/gnp"
-          cd "$RUNNER_TEMP/gnp"
-          git checkout c1e31d21c240162920cbf87c62a47e3ce306944a
-          corepack enable
-          yarn install --immutable
-          yarn build
+          git -C "$RUNNER_TEMP/gnp" checkout 5001ba9cbd9795b904c2be3090f161a5392a6651
       - name: Publish npm packages
         run: >-
           node "$RUNNER_TEMP/gnp/dist/cli.cjs" publish

From 91fdab86b17eb3d38cfdd09ed1a6d7e24d134359 Mon Sep 17 00:00:00 2001
From: Kim Gustyr <kim.gustyr@flagsmith.com>
Date: Wed, 19 Aug 2026 16:53:49 +0100
Subject: [PATCH 3/3] ci: Set repository in published npm packages (required
 for provenance)

---
 .github/workflows/release.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 069232f..3b1949a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,13 +59,13 @@ jobs:
         with:
           node-version: 24 # npm >= 11.5.1 required for OIDC trusted publishing
       # TODO: switch to goreleaser-npm-publisher-action once https://github.com/evg4b/goreleaser-npm-publisher/pull/26 is released
-      # Prebuilt dist committed on the fork branch (c1e31d2 + dist/, built and
+      # Prebuilt dist committed on the fork branch (5e09f1e + dist/, built and
       # smoke-tested locally). Deliberately no yarn install/build here: this job
       # holds id-token: write, so third-party install scripts must not run in it.
       - name: Fetch goreleaser-npm-publisher
         run: |
           git clone https://github.com/khvn26/goreleaser-npm-publisher "$RUNNER_TEMP/gnp"
-          git -C "$RUNNER_TEMP/gnp" checkout 5001ba9cbd9795b904c2be3090f161a5392a6651
+          git -C "$RUNNER_TEMP/gnp" checkout ad16d393106b23b6289d0569beefb8e9b3bd3159
       - name: Publish npm packages
         run: >-
           node "$RUNNER_TEMP/gnp/dist/cli.cjs" publish
@@ -73,6 +73,7 @@ jobs:
           --bin flagsmith
           --prefix @flagsmith
           --license MIT
+          --repository 'git+https://github.com/Flagsmith/flagsmith-cli.git'
           --description 'The Flagsmith command-line interface'
           --keywords flagsmith feature-flags cli
           --files README.md LICENSE